Red Hat Security Advisory: Red Hat Virtualization Host security update [ovirt-4.5.3-1]

Fixed packages 2

Vulnerabilities 5

• Critical 9.8
  CVE-2022-3515

  A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability ca…

  libksba libksba gnupg2 libksba Debian Ubuntu Azure Linux Alpine
  Jan 12, 2023
• High 8.1
  CVE-2022-40674

  libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Sep 14, 2022
• High 7.5
  CVE-2022-38177

  Memory leak in ECDSA DNSSEC verification code

  By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

  ISC BIND9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  Sep 21, 2022
• High 7.5
  CVE-2022-38178

  Memory leaks in EdDSA DNSSEC verification code

  By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

  ISC BIND9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  Sep 21, 2022
• Unscored —
  CVE-2022-41974

  multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in con…

  multipath-tools multipath-tools device-mapper-multipath Debian Ubuntu Azure Linux
  Oct 29, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2127936
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128602
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128986
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2130769
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2133988
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135610
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8598.json
• report
  https://access.redhat.com/security/cve/CVE-2022-3515
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3515
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3515
• article
  https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html
• report
  https://access.redhat.com/security/cve/CVE-2022-38177
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-38177
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-38177
• article
  https://kb.isc.org/docs/cve-2022-38177
• report
  https://access.redhat.com/security/cve/CVE-2022-38178
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-38178
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-38178
• article
  https://kb.isc.org/docs/cve-2022-38178
• report
  https://access.redhat.com/security/cve/CVE-2022-40674
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40674
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40674
• article
  https://blog.hartwork.org/posts/expat-2-4-9-released/
• advisory
  https://github.com/advisories/GHSA-2vq2-xc55-3j5m
• report
  https://access.redhat.com/security/cve/CVE-2022-41974
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41974
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41974
• article
  https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt